Privacy & cookies
Last updated: 29 August 2026
The short version. CineLogger is a personal film diary. To run it we store your account and the entries you log. One cookie keeps you signed in. Google Analytics runs only if you accept it on the banner. We never sell or share your data, and there is no advertising or ad-tracking. You can export everything you've logged, or delete your account, from your profile at any time.
Who runs this site
CineLogger is an independent project run by Angelo Edades ("we", "us"). For anything about privacy, email privacy@aedad.es. For UK data protection law, Angelo Edades is the "data controller" for this site.
What we collect and why
Your account
When you register we store your email address and a one-way hash of your password (never the password itself). Your profile also holds an optional display name, your currency preference, and which cinema memberships you've told us you hold, plus the date you joined. We use this to sign you in and to show your diary and totals the way you set them up.
Your diary entries
Everything you log: the film, the cinema or streaming venue (including a venue name you type in yourself), the date you watched it, whether it was a rewatch, the ticket prices you record (the standard price and what you actually paid), any notes you write, and any tags you add. This is the whole point of the service — it's stored so it's there when you come back, and it's only ever shown to you.
API keys
If you create an API key to add entries programmatically, we store a hash of it (same as your password) so the key can be checked without us keeping a copy of it.
Activity log
For security and troubleshooting, the server records each request to the site: the page requested, the method and response status, a short description of the action, a timestamp, and who made it — your account if you're signed in, or your IP address if you're not. Sensitive actions (signing in and out, registration, API-key changes, account deletion, and admin actions) get a specific description. We use this to spot and investigate abuse and to work out what went wrong when something breaks.
Settings saved on your device
Your list/grid view choice, whether you've dismissed the setup checklist, and an in-progress bulk edit are kept in your browser's local storage. This stays on your device, is not sent anywhere, and we can't see it.
Google Analytics (GA4) — only if you accept
When you first visit, a banner asks whether to allow analytics. It runs only if you choose
"Accept"; if you reject it (or ignore it), no analytics cookies are set — Google's
"consent mode" keeps analytics storage switched off until then. When enabled, it records the
pages you view, your approximate location (country/city, derived from your IP address — Google
does not give us your full IP), your device and browser type, and how you reached the site.
Google sets cookies (for example _ga) to recognise repeat visits. The Analytics
property is G-LM225Z536J. We have not enabled Google's
advertising or cross-site features. You can change your choice at any time using the control
under "Cookies" below.
Third-party film data (TMDB)
Film search, posters, and details come from The Movie Database (TMDB). When you search for or open a film, our server queries the TMDB API — your browser does not contact TMDB directly, and we don't send TMDB anything that identifies you. Posters are cached on our server and served from our own domain. CineLogger uses the TMDB API but is not endorsed or certified by TMDB.
Hosting logs
Our hosting provider keeps standard server logs (IP address, timestamp, the page requested, and similar) to keep the site available and secure. These are retained for a short period and then deleted.
What we don't do
No advertising, no ad-tracking pixels, no browser fingerprinting, no selling or sharing of personal data, and no third-party trackers beyond the Google Analytics described above. Your diary is never shown to other users or made public.
Cookies
One cookie is essential: a session cookie that keeps you signed in and carries the form-security
(CSRF) token. It is not used for tracking, and the site does not work without it. In production
it is set with the __Host- prefix, which ties it to this one site.
The only other cookies are the Google Analytics ones described above, and they are set only after you accept on the banner. Nothing about the site stops working if you reject.
Separately, the site remembers small preferences (view choice, dismissed checklist, bulk-edit draft) in your browser's local storage. That isn't a cookie, never leaves your device, and is needed for those features to work.
Legal basis (UK GDPR)
- Your account and diary entries: performance of a contract — we can't provide the diary you signed up for without storing it.
- Activity log and security: our legitimate interest in keeping the site secure and available and in investigating misuse.
- Google Analytics: your consent, given via the cookie banner and withdrawable at any time.
- The session cookie: strictly necessary for a service you've asked for (signing in), so no consent is required.
- Preferences on your device: necessary to provide the feature you asked for (remembering your setting).
Who we share it with
We don't sell or share your personal data. It is handled on our behalf by our hosting provider (Krystal Hosting, UK) and, if you accept analytics, Google (Google Analytics). TMDB receives film-search queries from our server but nothing that identifies you.
How long we keep it
Your account and diary entries are kept until you delete your account or ask us to remove them. The activity log is kept while it remains useful for security and troubleshooting. Analytics data is retained according to Google's settings for the property.
Your rights
Under the UK GDPR you can ask us what personal data we hold about you, ask us to correct or delete it, object to our processing, or ask for a copy to take elsewhere. Some of this is built in: your profile lets you edit your details, Export diary downloads everything you've logged as a CSV file, and Delete account removes your account, your diary entries, and your API keys. When you delete your account, the activity log keeps its record that those actions happened — including the email address and IP address recorded at the time — because that log is our account of what took place on the site.
For anything else, email privacy@aedad.es and we'll respond within one month. If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.
Other services and links
This site uses Google Analytics — see Google's Privacy Policy. Film data and images come from TMDB, which has its own privacy policy. Links out to other sites are governed by their own policies.
Changes
If this changes we'll update this page and the "last updated" date above.